From patchwork Sat Jun 25 13:41:46 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 2553 Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director10.mail.ord1d.rsapps.net ([172.31.255.6]) by backend30.mail.ord1d.rsapps.net with LMTP id 8EVmJ4ydt2K/GwAAIUCqbw (envelope-from ) for ; Sat, 25 Jun 2022 19:43:08 -0400 Received: from proxy13.mail.iad3b.rsapps.net ([172.31.255.6]) by director10.mail.ord1d.rsapps.net with LMTP id uNlBJ4ydt2JtWAAApN4f7A (envelope-from ) for ; Sat, 25 Jun 2022 19:43:08 -0400 Received: from smtp17.gate.iad3b ([172.31.255.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy13.mail.iad3b.rsapps.net with LMTPS id 8I2EIIydt2JNfQAAvUvv+w (envelope-from ) for ; Sat, 25 Jun 2022 19:43:08 -0400 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp17.gate.iad3b.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 90301e80-f4e0-11ec-b7dd-52540094e46f-1-1 Received: from [216.105.38.7] ([216.105.38.7:33988] helo=lists.sourceforge.net) by smtp17.gate.iad3b.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id F0/78-08119-B8D97B26; Sat, 25 Jun 2022 19:43:08 -0400 Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.94.2) (envelope-from ) id 1o5FPk-0003EG-3P; Sat, 25 Jun 2022 23:42:08 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1o5FPi-0003Du-D0 for openvpn-devel@lists.sourceforge.net; Sat, 25 Jun 2022 23:42:06 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:Message-Id: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:In-Reply-To:References:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=08H4yIcIZSxnBdc2xWCpjigBw07xYIYe7hg/pqzBRDo=; b=RfIZZ6IiADX5fzXpJ3ppzSpTQD /O+Dueh0Gs6Yx0f3T7zJIJDObpG2zbnPt32/EC284oOO6xU1hizXOhrGCftknRwdKaYC0IZxEhlXM xq9ah0/PgPG5WLeBk6MAFx/a2o3h6uaR41FgM0fWSASc9CqZnSR52JO9UpIPf/4O8PYc=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:Message-Id:Date:Subject:To:From: Sender:Reply-To:Cc:Content-Type:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post: List-Owner:List-Archive; bh=08H4yIcIZSxnBdc2xWCpjigBw07xYIYe7hg/pqzBRDo=; b=R fQSPTa2yvVYpoev0YNdBwAH5KZ218/bEuEYlvYxTKIbot7jLcpEgSnRNe9NU2sIJPMsJOrLn7fxVc w8DzG2X2Vz/Gzf21ih1VefjqAR9747kBlhzG1c5z/yBuhkBBKDT9lb4PqnDn8X6YPSaOI55y6VH1j pUgyFJTiepoHKu10=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.94.2) id 1o5FPe-00Dy3C-TK for openvpn-devel@lists.sourceforge.net; Sat, 25 Jun 2022 23:42:06 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.95 (FreeBSD)) (envelope-from ) id 1o5FPS-000Iif-U5 for openvpn-devel@lists.sourceforge.net; Sun, 26 Jun 2022 01:41:50 +0200 Received: (nullmailer pid 3398912 invoked by uid 10006); Sat, 25 Jun 2022 23:41:50 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Sun, 26 Jun 2022 01:41:46 +0200 Message-Id: <20220625234150.3398864-1-arne@rfc2549.org> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-Spam-Report: Spam detection software, running on the system "util-spamd-1.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: This allow the code later to check if the cipher is okay to use and update it for the calculation for the max MTU size. Signed-off-by: Arne Schwabe --- src/openvpn/ssl.c | 11 + src/openvpn/ssl_ncp.c | 22 ++++++++++++++++++++++ src/openvpn/ssl_ncp.h | 8 ++++++++ 3 files changed, 31 insertion [...] Content analysis details: (0.3 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 SPF_NONE SPF: sender does not publish an SPF Record X-Headers-End: 1o5FPe-00Dy3C-TK Subject: [Openvpn-devel] [PATCH v3 1/5] Extract update_session_cipher into standalone function X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox This allow the code later to check if the cipher is okay to use and update it for the calculation for the max MTU size. Signed-off-by: Arne Schwabe --- src/openvpn/ssl.c | 11 +---------- src/openvpn/ssl_ncp.c | 22 ++++++++++++++++++++++ src/openvpn/ssl_ncp.h | 8 ++++++++ 3 files changed, 31 insertions(+), 10 deletions(-) diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c index 61dea996d..ddd90080b 100644 --- a/src/openvpn/ssl.c +++ b/src/openvpn/ssl.c @@ -1678,17 +1678,8 @@ tls_session_update_crypto_params(struct tls_session *session, struct frame *frame_fragment, struct link_socket_info *lsi) { - - bool cipher_allowed_as_fallback = options->enable_ncp_fallback - && streq(options->ciphername, session->opt->config_ciphername); - - if (!session->opt->server && !cipher_allowed_as_fallback - && !tls_item_in_cipher_list(options->ciphername, options->ncp_ciphers)) + if (!update_session_cipher(session, options)) { - msg(D_TLS_ERRORS, "Error: negotiated cipher not allowed - %s not in %s", - options->ciphername, options->ncp_ciphers); - /* undo cipher push, abort connection setup */ - options->ciphername = session->opt->config_ciphername; return false; } diff --git a/src/openvpn/ssl_ncp.c b/src/openvpn/ssl_ncp.c index 564942503..c800f718f 100644 --- a/src/openvpn/ssl_ncp.c +++ b/src/openvpn/ssl_ncp.c @@ -490,3 +490,25 @@ p2p_mode_ncp(struct tls_multi *multi, struct tls_session *session) gc_free(&gc); } + + +bool +update_session_cipher(struct tls_session *session, struct options *options) +{ + bool cipher_allowed_as_fallback = options->enable_ncp_fallback + && streq(options->ciphername, session->opt->config_ciphername); + + if (!session->opt->server && !cipher_allowed_as_fallback + && !tls_item_in_cipher_list(options->ciphername, options->ncp_ciphers)) + { + msg(D_TLS_ERRORS, "Error: negotiated cipher not allowed - %s not in %s", + options->ciphername, options->ncp_ciphers); + /* undo cipher push, abort connection setup */ + options->ciphername = session->opt->config_ciphername; + return false; + } + else + { + return true; + } +} diff --git a/src/openvpn/ssl_ncp.h b/src/openvpn/ssl_ncp.h index 853017f5f..5ba2f7ae7 100644 --- a/src/openvpn/ssl_ncp.h +++ b/src/openvpn/ssl_ncp.h @@ -148,4 +148,12 @@ const char * get_p2p_ncp_cipher(struct tls_session *session, const char *peer_info, struct gc_arena *gc); + +/** + * Checks if the cipher is allowed and updates the TLS session cipher with it, + * otherwise returns false + */ +bool +update_session_cipher(struct tls_session *session, struct options *options); + #endif /* ifndef OPENVPN_SSL_NCP_H */ From patchwork Sat Jun 25 13:41:47 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 2554 Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director8.mail.ord1d.rsapps.net ([172.31.255.6]) by backend30.mail.ord1d.rsapps.net with LMTP id YLelGo2dt2K9GwAAIUCqbw (envelope-from ) for ; Sat, 25 Jun 2022 19:43:09 -0400 Received: from proxy7.mail.iad3b.rsapps.net ([172.31.255.6]) by director8.mail.ord1d.rsapps.net with LMTP id UAl9Go2dt2ILRgAAfY0hYg (envelope-from ) for ; Sat, 25 Jun 2022 19:43:09 -0400 Received: from smtp23.gate.iad3b ([172.31.255.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy7.mail.iad3b.rsapps.net with LMTPS id dTNsEo2dt2IGRwAAQkQ5tQ (envelope-from ) for ; Sat, 25 Jun 2022 19:43:09 -0400 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp23.gate.iad3b.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 90c95eec-f4e0-11ec-864c-525400aa5716-1-1 Received: from [216.105.38.7] ([216.105.38.7:34002] helo=lists.sourceforge.net) by smtp23.gate.iad3b.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 4E/F0-27394-C8D97B26; Sat, 25 Jun 2022 19:43:08 -0400 Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.94.2) (envelope-from ) id 1o5FPm-0003Eg-92; Sat, 25 Jun 2022 23:42:10 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1o5FPk-0003ER-9d for openvpn-devel@lists.sourceforge.net; Sat, 25 Jun 2022 23:42:08 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=NLAYy/RGxvGl6RePXbYAUvvklXq0sHaBnUDX8GEGm7c=; b=exACbKdWgTmD87bbdwsM2iQl1U ipYobQu6LONsDXcNHvZU+aT84LVYNWkbcWyaSSL3kSCraGc72l9j44Z++zAmWgjJLEsgz1hzHXdlH ap/MZOFea7lba0z5Q20ya4uIQ9XwPsfKEM9R3ylG16a7Lxtn3jzoWiDMdiU0CkWuOb94=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=NLAYy/RGxvGl6RePXbYAUvvklXq0sHaBnUDX8GEGm7c=; b=j9YdwwJY+mMnDQ6fCWoHM13BzB SDowA80co3s0KNZbmAJ8RsMfTnOAxnmGPmjMSRnnezAiFfpT3A2mAGaVY3GzZ9wURrcs/GzBQBiiF uy16+ipNvjT6xTkjo0N0lX9HL3iLgf6CGNAxH/A8lbR0xSZLv49QXgw1bJtPlEA3zjAI=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.94.2) id 1o5FPi-0002ou-Vb for openvpn-devel@lists.sourceforge.net; Sat, 25 Jun 2022 23:42:08 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.95 (FreeBSD)) (envelope-from ) id 1o5FPS-000Iih-Vz for openvpn-devel@lists.sourceforge.net; Sun, 26 Jun 2022 01:41:50 +0200 Received: (nullmailer pid 3398915 invoked by uid 10006); Sat, 25 Jun 2022 23:41:50 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Sun, 26 Jun 2022 01:41:47 +0200 Message-Id: <20220625234150.3398864-2-arne@rfc2549.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20220625234150.3398864-1-arne@rfc2549.org> References: <20220625234150.3398864-1-arne@rfc2549.org> MIME-Version: 1.0 X-Spam-Report: Spam detection software, running on the system "util-spamd-1.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: This allows tun-mtu to pushed but only up to the size of the preallocated buffers. This is not a perfect solution but should allow most of the use cases where the mtu is close enough to 1500. Signed-off-by: Arne Schwabe --- Changes.rst | 8 ++++ doc/man-sections/client-options.rst | 4 ++ doc/man-sections/vpn-network-options.rst | 5 +++ src/openvpn/init.c | 50 ++++++++++++ [...] Content analysis details: (0.3 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 SPF_NONE SPF: sender does not publish an SPF Record X-Headers-End: 1o5FPi-0002ou-Vb Subject: [Openvpn-devel] [PATCH v3 2/5] Allow tun-mtu to be pushed X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox This allows tun-mtu to pushed but only up to the size of the preallocated buffers. This is not a perfect solution but should allow most of the use cases where the mtu is close enough to 1500. Signed-off-by: Arne Schwabe --- Changes.rst | 8 ++++ doc/man-sections/client-options.rst | 4 ++ doc/man-sections/vpn-network-options.rst | 5 +++ src/openvpn/init.c | 50 ++++++++++++++++++++---- src/openvpn/mtu.c | 1 + src/openvpn/mtu.h | 3 ++ src/openvpn/options.c | 15 ++++++- src/openvpn/options.h | 3 ++ src/openvpn/ssl.c | 3 ++ 9 files changed, 84 insertions(+), 8 deletions(-) diff --git a/Changes.rst b/Changes.rst index 67a23c792..8462f7888 100644 --- a/Changes.rst +++ b/Changes.rst @@ -79,6 +79,14 @@ Cookie based handshake for UDP server shake. The tls-crypt-v2 option allows controlling if older clients are accepted. + +Tun MTU can be pushed + As part of changing the ``--tun-mtu`` default to 1420 (see below), the + client can now also dynamically configure its MTU and the server will + try to push the client MTU when the client supports it. The directive + ``--tun-mtu-max`` has been introduced to specify the maximum pushable + MTU size. + Deprecated features ------------------- ``inetd`` has been removed diff --git a/doc/man-sections/client-options.rst b/doc/man-sections/client-options.rst index 8e0e4f18a..940175eaf 100644 --- a/doc/man-sections/client-options.rst +++ b/doc/man-sections/client-options.rst @@ -358,6 +358,10 @@ configuration. The client announces the list of supported ciphers configured with the ``--data-ciphers`` option to the server. + :code:`IV_MTU=` + The client announces the support of pushable MTU and the maximum MTU + it is willing to accept. + :code:`IV_GUI_VER= ` The UI version of a UI if one is running, for example :code:`de.blinkt.openvpn 0.5.47` for the Android app. diff --git a/doc/man-sections/vpn-network-options.rst b/doc/man-sections/vpn-network-options.rst index 5b2f84707..2d0e662e4 100644 --- a/doc/man-sections/vpn-network-options.rst +++ b/doc/man-sections/vpn-network-options.rst @@ -516,6 +516,11 @@ routing. It's best to use the ``--fragment`` and/or ``--mssfix`` options to deal with MTU sizing issues. +--tun-max-mtu maxmtu + This configures the maximum MTU size that a server can push to ``maxmtu``. + The default for ``maxmtu`` is 1600. This will increase internal buffers + allocation for larger packet sizes. + --tun-mtu-extra n Assume that the TUN/TAP device might return as many as ``n`` bytes more than the ``--tun-mtu`` size on read. This parameter defaults to 0, which diff --git a/src/openvpn/init.c b/src/openvpn/init.c index 638fd10c8..246dbae9e 100644 --- a/src/openvpn/init.c +++ b/src/openvpn/init.c @@ -2126,7 +2126,8 @@ pull_permission_mask(const struct context *c) | OPT_P_ECHO | OPT_P_PULL_MODE | OPT_P_PEER_ID - | OPT_P_NCP; + | OPT_P_NCP + | OPT_P_PUSH_MTU; if (!c->options.route_nopull) { @@ -2285,6 +2286,31 @@ do_deferred_options(struct context *c, const unsigned int found) #endif struct tls_session *session = &c->c2.tls_multi->session[TM_ACTIVE]; + if (!update_session_cipher(session, &c->options)) + { + /* The update_session_cipher method will already print an error */ + return false; + } + + /* Cipher is considered safe, so we can use it to calculate the max + * MTU size */ + if (found & OPT_P_PUSH_MTU) + { + /* MTU has changed, check that the pushed MTU is small enough to + * be able to change it */ + msg(D_PUSH, "OPTIONS IMPORT: tun-mtu set to %d", c->options.ce.tun_mtu); + + struct frame *frame = &c->c2.frame; + + if (c->options.ce.tun_mtu > frame->tun_max_mtu) + { + msg(D_PUSH_ERRORS, "Server pushed a large mtu, please add " + "tun-mtu-max %d in the client configuration", + c->options.ce.tun_mtu); + } + frame->tun_mtu = min_int(frame->tun_max_mtu, c->options.ce.tun_mtu); + } + if (!tls_session_update_crypto_params(session, &c->options, &c->c2.frame, frame_fragment, get_link_socket_info(c))) { @@ -2448,10 +2474,16 @@ frame_finalize_options(struct context *c, const struct options *o) struct frame *frame = &c->c2.frame; frame->tun_mtu = get_frame_mtu(c, o); + frame->tun_max_mtu = o->ce.tun_mtu_max; - /* We always allow at least 1500 MTU packets to be received in our buffer - * space */ - size_t payload_size = max_int(1500, frame->tun_mtu); + /* max mtu needs to be at least as large as the tun mtu */ + frame->tun_max_mtu = max_int(frame->tun_mtu, frame->tun_max_mtu); + + /* We always allow at least 1600 MTU packets to be received in our buffer + * space to allow server to push "baby giant" MTU sizes */ + frame->tun_max_mtu = max_int(1600, frame->tun_max_mtu); + + size_t payload_size = frame->tun_max_mtu; /* The extra tun needs to be added to the payload size */ if (o->ce.tun_mtu_defined) @@ -2459,9 +2491,9 @@ frame_finalize_options(struct context *c, const struct options *o) payload_size += o->ce.tun_mtu_extra; } - /* Add 100 byte of extra space in the buffer to account for slightly - * mismatched MUTs between peers */ - payload_size += 100; + /* Add 32 byte of extra space in the buffer to account for small errors + * in the calculation */ + payload_size += 32; /* the space that is reserved before the payload to add extra headers to it @@ -2994,6 +3026,10 @@ do_init_frame_tls(struct context *c) c->c2.frame.buf.payload_size); frame_print(&c->c2.tls_multi->opt.frame, D_MTU_INFO, "Control Channel MTU parms"); + + /* Keep the max mtu also in the frame of tls multi so it can access + * it in push_peer_info */ + c->c2.tls_multi->opt.frame.tun_max_mtu = c->c2.frame.tun_max_mtu; } if (c->c2.tls_auth_standalone) { diff --git a/src/openvpn/mtu.c b/src/openvpn/mtu.c index 59b917985..8fc45b341 100644 --- a/src/openvpn/mtu.c +++ b/src/openvpn/mtu.c @@ -222,6 +222,7 @@ frame_print(const struct frame *frame, buf_printf(&out, " max_frag:%d", frame->max_fragment_size); #endif buf_printf(&out, " tun_mtu:%d", frame->tun_mtu); + buf_printf(&out, " tun_max_mtu:%d", frame->tun_max_mtu); buf_printf(&out, " headroom:%d", frame->buf.headroom); buf_printf(&out, " payload:%d", frame->buf.payload_size); buf_printf(&out, " tailroom:%d", frame->buf.tailroom); diff --git a/src/openvpn/mtu.h b/src/openvpn/mtu.h index 9db6cf26a..db6bddb42 100644 --- a/src/openvpn/mtu.h +++ b/src/openvpn/mtu.h @@ -133,6 +133,9 @@ struct frame { * control frame payload (although most of * code ignores it) */ + int tun_max_mtu; /**< the maximum tun-mtu size the buffers are + * are sized for. This is the upper bound that + * a server can push as MTU */ int extra_tun; /**< Maximum number of bytes in excess of * the tun/tap MTU that might be read diff --git a/src/openvpn/options.c b/src/openvpn/options.c index 9a0634a5e..c14ab1330 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -6264,10 +6264,23 @@ add_option(struct options *options, } else if (streq(p[0], "tun-mtu") && p[1] && !p[2]) { - VERIFY_PERMISSION(OPT_P_MTU|OPT_P_CONNECTION); + VERIFY_PERMISSION(OPT_P_PUSH_MTU|OPT_P_CONNECTION); options->ce.tun_mtu = positive_atoi(p[1]); options->ce.tun_mtu_defined = true; } + else if (streq(p[0], "tun-mtu-max") && p[1] && !p[3]) + { + VERIFY_PERMISSION(OPT_P_MTU|OPT_P_CONNECTION); + int max_mtu = positive_atoi(p[1]); + if (max_mtu < 68 || max_mtu > 65536) + { + msg(msglevel, "--tun-mtu-max value '%s' is invalid", p[1]); + } + else + { + options->ce.tun_mtu_max = max_mtu; + } + } else if (streq(p[0], "tun-mtu-extra") && p[1] && !p[2]) { VERIFY_PERMISSION(OPT_P_MTU|OPT_P_CONNECTION); diff --git a/src/openvpn/options.h b/src/openvpn/options.h index c2937dc37..52d6436b8 100644 --- a/src/openvpn/options.h +++ b/src/openvpn/options.h @@ -118,6 +118,8 @@ struct connection_entry const char *socks_proxy_authfile; int tun_mtu; /* MTU of tun device */ + int tun_mtu_max; /* maximum MTU that can be pushed */ + bool tun_mtu_defined; /* true if user overriding parm with command line option */ int tun_mtu_extra; bool tun_mtu_extra_defined; @@ -719,6 +721,7 @@ struct options #define OPT_P_CONNECTION (1<<27) #define OPT_P_PEER_ID (1<<28) #define OPT_P_INLINE (1<<29) +#define OPT_P_PUSH_MTU (1<<30) #define OPT_P_DEFAULT (~(OPT_P_INSTANCE|OPT_P_PULL_MODE)) diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c index ddd90080b..a6071e3c1 100644 --- a/src/openvpn/ssl.c +++ b/src/openvpn/ssl.c @@ -1939,6 +1939,9 @@ push_peer_info(struct buffer *buf, struct tls_session *session) { iv_proto |= IV_PROTO_REQUEST_PUSH; iv_proto |= IV_PROTO_AUTH_PENDING_KW; + + /* support for tun-mtu as part of the push message */ + buf_printf(&out, "IV_MTU=%d\n", session->opt->frame.tun_max_mtu); } /* support for Negotiable Crypto Parameters */ From patchwork Sat Jun 25 13:41:48 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 2556 Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director13.mail.ord1d.rsapps.net ([172.31.255.6]) by backend30.mail.ord1d.rsapps.net with LMTP id +KUcLJOdt2K/GwAAIUCqbw (envelope-from ) for ; Sat, 25 Jun 2022 19:43:15 -0400 Received: from proxy7.mail.iad3b.rsapps.net ([172.31.255.6]) by director13.mail.ord1d.rsapps.net with LMTP id OOQCLJOdt2LrGAAA91zNiA (envelope-from ) for ; Sat, 25 Jun 2022 19:43:15 -0400 Received: from smtp24.gate.iad3b ([172.31.255.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy7.mail.iad3b.rsapps.net with LMTPS id QCH4I5Odt2JbRgAAQkQ5tQ (envelope-from ) for ; Sat, 25 Jun 2022 19:43:15 -0400 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp24.gate.iad3b.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 94bb3818-f4e0-11ec-9973-525400892b35-1-1 Received: from [216.105.38.7] ([216.105.38.7:34062] helo=lists.sourceforge.net) by smtp24.gate.iad3b.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 0B/84-25362-39D97B26; Sat, 25 Jun 2022 19:43:15 -0400 Received: from [127.0.0.1] (helo=sfs-ml-1.v29.lw.sourceforge.com) by sfs-ml-1.v29.lw.sourceforge.com with esmtp (Exim 4.94.2) (envelope-from ) id 1o5FPk-0003EL-5y; Sat, 25 Jun 2022 23:42:08 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-1.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1o5FPi-0003E1-I8 for openvpn-devel@lists.sourceforge.net; Sat, 25 Jun 2022 23:42:06 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=zhD6qxxHmlfwpZUMsbUfOFE7FMH7GjsjTxPsn1G8p2w=; b=OJdw9RqP2flLFkyOBCasATFB/K npEAx8+2FG9fscjz7U0MtpF/Pv5KyKPeAodiTuNrnBurb6WbBQQyL2/EfW3IBTBSgCdenx9cJAfz9 A+webkGHUksD5GnqJmXCJ/o3Gk4QcdcEtMsP/hkCUatCYWOC79IkcUqsG4f6lkdOjGMQ=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=zhD6qxxHmlfwpZUMsbUfOFE7FMH7GjsjTxPsn1G8p2w=; b=gGXTIf/6TixwIyq9xwl3aqhMpG ZfRqhySZSGrvYdEanQE/Wxy5vsdxQNqNoCzRGbMaP39DztoabaeUP9Br/MmwJkD83FBLOZQ1x8ItW xtENkCQ1cMWW9135wVM08TPxOKXPLYNmV7TRySK1ncTVDhdjh4MKF8AivGXEE+6fUC/A=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-1.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.94.2) id 1o5FPf-00Dy3D-1b for openvpn-devel@lists.sourceforge.net; Sat, 25 Jun 2022 23:42:06 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.95 (FreeBSD)) (envelope-from ) id 1o5FPT-000Iij-1q for openvpn-devel@lists.sourceforge.net; Sun, 26 Jun 2022 01:41:51 +0200 Received: (nullmailer pid 3398918 invoked by uid 10006); Sat, 25 Jun 2022 23:41:50 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Sun, 26 Jun 2022 01:41:48 +0200 Message-Id: <20220625234150.3398864-3-arne@rfc2549.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20220625234150.3398864-1-arne@rfc2549.org> References: <20220625234150.3398864-1-arne@rfc2549.org> MIME-Version: 1.0 X-Spam-Report: Spam detection software, running on the system "util-spamd-2.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: To maximise compatibility allow to lie our MTU in the default OCC message. Patch v2: improve documentation Patch v3: split changing default MTU into its own patch Signed-off-by: Arne Schwabe --- Changes.rst | 5 +++++ doc/man-sections/vpn-network-options.rst | 27 ++++++++++++++++++++---- src/openvpn/options.c | 21 ++++++++++++++++-- src/openvp [...] Content analysis details: (0.2 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 SPF_NONE SPF: sender does not publish an SPF Record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different -0.0 T_SCC_BODY_TEXT_LINE No description available. X-Headers-End: 1o5FPf-00Dy3D-1b Subject: [Openvpn-devel] [PATCH v3 3/5] Push server mtu to client when support and support occ mtu X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox To maximise compatibility allow to lie our MTU in the default OCC message. Patch v2: improve documentation Patch v3: split changing default MTU into its own patch Signed-off-by: Arne Schwabe Acked-by: Heiko Hund --- Changes.rst | 5 +++++ doc/man-sections/vpn-network-options.rst | 27 ++++++++++++++++++++---- src/openvpn/options.c | 21 ++++++++++++++++-- src/openvpn/options.h | 1 + src/openvpn/push.c | 16 ++++++++++++++ 5 files changed, 64 insertions(+), 6 deletions(-) diff --git a/Changes.rst b/Changes.rst index 8462f7888..616a977ed 100644 --- a/Changes.rst +++ b/Changes.rst @@ -149,6 +149,11 @@ User-visible Changes - Option ``--nobind`` is default when ``--client`` or ``--pull`` is used in the configuration - :code:`link_mtu` parameter is removed from environment or replaced with 0 when scripts are called with parameters. This parameter is unreliable and no longer internally calculated. +- the default of ``--tun-mtu`` has been changed to ``--tun-mtu 1420 1500`` when + running in server mode. This will create an MTU mismatch with older clients + (newer clients allow pushable mtu) but the most common server platforms + (Linux and FreeBSD) allow receiving 1500 byte packets even when tun-mtu is + set to 1420, still allowing larger packets from clients with 1500 byte MTU. Overview of changes in 2.5 ========================== diff --git a/doc/man-sections/vpn-network-options.rst b/doc/man-sections/vpn-network-options.rst index 2d0e662e4..9a09aef8b 100644 --- a/doc/man-sections/vpn-network-options.rst +++ b/doc/man-sections/vpn-network-options.rst @@ -500,10 +500,25 @@ routing. arguments of ``--ifconfig`` to mean "address netmask", no longer "local remote". ---tun-mtu n - Take the TUN device MTU to be **n** and derive the link MTU from it - (default :code:`1500`). In most cases, you will probably want to leave - this parameter set to its default value. +--tun-mtu args + + Valid syntaxes: + :: + + tun-mtu tun-mtu + tun-mtu tun-mtu occ-mtu + + Take the TUN device MTU to be ``tun-mtu`` and derive the link MTU from it. + In most cases, you will probably want to leave this parameter set to + its default value. + + Starting with OpenVPN 2.6 when running server mode (``--mode server``, + ``--server``, or ``-server-ipv6`` options present in the configuration), + the default will be 1420 for the tun mtu size and 1500 for the ``occ-mtu``. + + The OCC MTU can be used to avoid warnings about mismatched MTU from + clients. If :code:`occ-mtu` is not specified, it will to default to the + tun-mtu. The MTU (Maximum Transmission Units) is the maximum datagram size in bytes that can be sent unfragmented over a particular network path. @@ -516,6 +531,10 @@ routing. It's best to use the ``--fragment`` and/or ``--mssfix`` options to deal with MTU sizing issues. + Note: Depending on the platform, the operating system allows to receive + packets larger than ``tun-mtu`` (e.g. Linux and FreeBSD) but other platforms + (like macOS) limit received packets to the same size as the MTU. + --tun-max-mtu maxmtu This configures the maximum MTU size that a server can push to ``maxmtu``. The default for ``maxmtu`` is 1600. This will increase internal buffers diff --git a/src/openvpn/options.c b/src/openvpn/options.c index c14ab1330..f162b0b41 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -814,6 +814,7 @@ init_options(struct options *o, const bool init_gc) o->status_file_version = 1; o->ce.bind_local = true; o->ce.tun_mtu = TUN_MTU_DEFAULT; + o->ce.occ_mtu = 0; o->ce.link_mtu = LINK_MTU_DEFAULT; o->ce.mtu_discover_type = -1; o->ce.mssfix = 0; @@ -4018,7 +4019,15 @@ options_string(const struct options *o, buf_printf(&out, ",link-mtu %u", (unsigned int) calc_options_string_link_mtu(o, frame)); - buf_printf(&out, ",tun-mtu %d", frame->tun_mtu); + if (o->ce.occ_mtu != 0) + { + buf_printf(&out, ",tun-mtu %d", o->ce.occ_mtu); + } + else + { + buf_printf(&out, ",tun-mtu %d", frame->tun_mtu); + } + buf_printf(&out, ",proto %s", proto_remote(o->ce.proto, remote)); bool p2p_nopull = o->mode == MODE_POINT_TO_POINT && !PULL_DEFINED(o); @@ -6262,11 +6271,19 @@ add_option(struct options *options, options->ce.link_mtu = positive_atoi(p[1]); options->ce.link_mtu_defined = true; } - else if (streq(p[0], "tun-mtu") && p[1] && !p[2]) + else if (streq(p[0], "tun-mtu") && p[1] && !p[3]) { VERIFY_PERMISSION(OPT_P_PUSH_MTU|OPT_P_CONNECTION); options->ce.tun_mtu = positive_atoi(p[1]); options->ce.tun_mtu_defined = true; + if (p[2]) + { + options->ce.occ_mtu = positive_atoi(p[2]); + } + else + { + options->ce.occ_mtu = 0; + } } else if (streq(p[0], "tun-mtu-max") && p[1] && !p[3]) { diff --git a/src/openvpn/options.h b/src/openvpn/options.h index 52d6436b8..bf17764f0 100644 --- a/src/openvpn/options.h +++ b/src/openvpn/options.h @@ -118,6 +118,7 @@ struct connection_entry const char *socks_proxy_authfile; int tun_mtu; /* MTU of tun device */ + int occ_mtu; /* if non-null, this is the MTU we announce to peers in OCC */ int tun_mtu_max; /* maximum MTU that can be pushed */ bool tun_mtu_defined; /* true if user overriding parm with command line option */ diff --git a/src/openvpn/push.c b/src/openvpn/push.c index 63257348a..8a396a82c 100644 --- a/src/openvpn/push.c +++ b/src/openvpn/push.c @@ -603,6 +603,22 @@ prepare_push_reply(struct context *c, struct gc_arena *gc, { push_option_fmt(gc, push_list, M_USAGE, "key-derivation tls-ekm"); } + + /* Push our mtu to the peer if it supports pushable MTUs */ + int client_max_mtu = 0; + const char *iv_mtu = extract_var_peer_info(tls_multi->peer_info, "IV_MTU=", gc); + + if (iv_mtu && sscanf(iv_mtu, "%d", &client_max_mtu) == 1) + { + push_option_fmt(gc, push_list, M_USAGE, "tun-mtu %d", o->ce.tun_mtu); + if (client_max_mtu < o->ce.tun_mtu) + { + msg(M_WARN, "Warning: reported maximum MTU from client (%d) is lower " + "than MTU used on the server (%d). Add tun-max-mtu %d " + "to client configuration.", client_max_mtu, + o->ce.tun_mtu, o->ce.tun_mtu); + } + } return true; } From patchwork Sat Jun 25 13:41:49 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 2557 Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director8.mail.ord1d.rsapps.net ([172.31.255.6]) by backend30.mail.ord1d.rsapps.net with LMTP id GLyXIJedt2K/GwAAIUCqbw (envelope-from ) for ; Sat, 25 Jun 2022 19:43:19 -0400 Received: from proxy11.mail.iad3b.rsapps.net ([172.31.255.6]) by director8.mail.ord1d.rsapps.net with LMTP id IBBuIJedt2JdRwAAfY0hYg (envelope-from ) for ; Sat, 25 Jun 2022 19:43:19 -0400 Received: from smtp4.gate.iad3b ([172.31.255.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy11.mail.iad3b.rsapps.net with LMTPS id 8CmVGZedt2LETgAARNREpw (envelope-from ) for ; Sat, 25 Jun 2022 19:43:19 -0400 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp4.gate.iad3b.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 96f0756c-f4e0-11ec-80c1-525400789c6c-1-1 Received: from [216.105.38.7] ([216.105.38.7:42652] helo=lists.sourceforge.net) by smtp4.gate.iad3b.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 32/09-11644-69D97B26; Sat, 25 Jun 2022 19:43:19 -0400 Received: from [127.0.0.1] (helo=sfs-ml-2.v29.lw.sourceforge.com) by sfs-ml-2.v29.lw.sourceforge.com with esmtp (Exim 4.94.2) (envelope-from ) id 1o5FPj-0002eW-Vt; Sat, 25 Jun 2022 23:42:08 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-2.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1o5FPi-0002eQ-TS for openvpn-devel@lists.sourceforge.net; Sat, 25 Jun 2022 23:42:07 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=uSYX8TqX4xtCdghb+PxxZbuXmtouseMp4mOFBSApO4k=; b=hNyAIgr4VUG7bW9Vuj9m8Ovu7W Jjn3Xw4qKTrN3CPmEC9PAYn6tJEAtLLjfp2bp70Kulv1QIfRa+AjN9+oFa89Nfkhpy0VDdJulXjzx e2QOTaP46XD8V8xeVwhlZu2Lo1Fu5mQKsTBWNWy71iU+7rHoIL4HP7ZDfU/xO9ZKCDI8=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=uSYX8TqX4xtCdghb+PxxZbuXmtouseMp4mOFBSApO4k=; b=cW+caC2nzFMBN2VdRCdLhF/a9H shZEy0x7VIJnBOjgJQfwFmjifdS32zbqzsbVM1FXQgxna3SI4t91xJn7s+UamYrmMh1oBkysJmn1j /Z6WItP64PR/yrHbMVHxIab+SurgOV73iVEAWAs9b8G5B5SsAFcb7Wu1L0hNCIMNITRI=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.94.2) id 1o5FPi-0002ov-Us for openvpn-devel@lists.sourceforge.net; Sat, 25 Jun 2022 23:42:07 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.95 (FreeBSD)) (envelope-from ) id 1o5FPT-000Iio-44 for openvpn-devel@lists.sourceforge.net; Sun, 26 Jun 2022 01:41:51 +0200 Received: (nullmailer pid 3398923 invoked by uid 10006); Sat, 25 Jun 2022 23:41:51 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Sun, 26 Jun 2022 01:41:49 +0200 Message-Id: <20220625234150.3398864-4-arne@rfc2549.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20220625234150.3398864-1-arne@rfc2549.org> References: <20220625234150.3398864-1-arne@rfc2549.org> MIME-Version: 1.0 X-Spam-Report: Spam detection software, running on the system "util-spamd-1.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: We could also just hardcode this value to 1420 but this approach does not add much (complicated) code and it is a bit better than to have a magic number to just be there. Signed-off-by: Arne Schwabe --- src/openvpn/mtu.c | 22 ++++++++++++++++++++++ src/openvpn/mtu.h | 14 ++++++++++++++ tests/unit_tests/openvpn/test_crypto.c | 19 ++++++++++++++++++- 3 [...] Content analysis details: (0.3 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 SPF_NONE SPF: sender does not publish an SPF Record X-Headers-End: 1o5FPi-0002ov-Us Subject: [Openvpn-devel] [PATCH v3 4/5] Implement a function to calculate the default MTU X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox We could also just hardcode this value to 1420 but this approach does not add much (complicated) code and it is a bit better than to have a magic number to just be there. Signed-off-by: Arne Schwabe --- src/openvpn/mtu.c | 22 ++++++++++++++++++++++ src/openvpn/mtu.h | 14 ++++++++++++++ tests/unit_tests/openvpn/test_crypto.c | 19 ++++++++++++++++++- 3 files changed, 54 insertions(+), 1 deletion(-) diff --git a/src/openvpn/mtu.c b/src/openvpn/mtu.c index 8fc45b341..e4d4a9cd5 100644 --- a/src/openvpn/mtu.c +++ b/src/openvpn/mtu.c @@ -205,6 +205,28 @@ calc_options_string_link_mtu(const struct options *o, const struct frame *frame) return payload + overhead; } +int +frame_calculate_default_mtu(struct options *o) +{ + struct options options = *o; + + /* assume we have peer_id enabled */ + options.use_peer_id = true; + + /* We use IPv6+UDP here to have a consistent size for tun MTU no matter + * the combination of udp/tcp and IPv4/IPv6 */ + int encap_overhead = datagram_overhead(AF_INET6, PROTO_UDP); + + struct key_type kt; + init_key_type(&kt, "AES-256-GCM", "none", true, false); + + size_t payload_overhead = frame_calculate_payload_overhead(0, &options, &kt, false); + size_t protocol_overhead = frame_calculate_protocol_header_size(&kt, &options, false); + + return MTU_ENCAP_DEFAULT - encap_overhead - payload_overhead - protocol_overhead; + +} + void frame_print(const struct frame *frame, int level, diff --git a/src/openvpn/mtu.h b/src/openvpn/mtu.h index db6bddb42..e80d8bd01 100644 --- a/src/openvpn/mtu.h +++ b/src/openvpn/mtu.h @@ -79,6 +79,10 @@ */ #define MSSFIX_DEFAULT 1492 +/* The default size we aim to reach to with our VPN packets by setting + * the MTU accordingly */ +#define MTU_ENCAP_DEFAULT 1492 + /* * Alignment of payload data such as IP packet or * ethernet frame. @@ -263,6 +267,16 @@ void alloc_buf_sock_tun(struct buffer *buf, const struct frame *frame, const bool tuntap_buffer); + +/** + * Function to calculate the default MTU for Layer 3 VPNs. The function + * assumes that UDP packets should be a maximum of \c MTU_ENCAP_DEFAULT (1492) + * with a AEAD cipher. This default comes out to be 1420. + */ +int +frame_calculate_default_mtu(struct options *o); + + /* * EXTENDED_SOCKET_ERROR_CAPABILITY functions -- print extra error info * on socket errors, such as PMTU size. As of 2003.05.11, only works diff --git a/tests/unit_tests/openvpn/test_crypto.c b/tests/unit_tests/openvpn/test_crypto.c index 83572b827..ca595b0a5 100644 --- a/tests/unit_tests/openvpn/test_crypto.c +++ b/tests/unit_tests/openvpn/test_crypto.c @@ -477,6 +477,22 @@ test_mssfix_mtu_calculation(void **state) gc_free(&gc); } + +static void +test_mtu_default_calculation(void **state) +{ + struct options o = {0}; + + /* common defaults */ + o.ce.tun_mtu = 1400; + o.ce.mssfix = 1000; + o.replay = true; + o.ce.proto = PROTO_UDP; + + size_t mtu = frame_calculate_default_mtu(&o); + assert_int_equal(1420, mtu); +} + int main(void) { @@ -487,7 +503,8 @@ main(void) cmocka_unit_test(crypto_test_hmac), cmocka_unit_test(test_des_encrypt), cmocka_unit_test(test_occ_mtu_calculation), - cmocka_unit_test(test_mssfix_mtu_calculation) + cmocka_unit_test(test_mssfix_mtu_calculation), + cmocka_unit_test(test_mtu_default_calculation) }; #if defined(ENABLE_CRYPTO_OPENSSL) From patchwork Sat Jun 25 13:41:50 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Arne Schwabe X-Patchwork-Id: 2555 Return-Path: Delivered-To: patchwork@openvpn.net Delivered-To: patchwork@openvpn.net Received: from director9.mail.ord1d.rsapps.net ([172.31.255.6]) by backend30.mail.ord1d.rsapps.net with LMTP id SL6/IJKdt2K9GwAAIUCqbw (envelope-from ) for ; Sat, 25 Jun 2022 19:43:14 -0400 Received: from proxy13.mail.iad3b.rsapps.net ([172.31.255.6]) by director9.mail.ord1d.rsapps.net with LMTP id INigIJKdt2KaPAAAalYnBA (envelope-from ) for ; Sat, 25 Jun 2022 19:43:14 -0400 Received: from smtp28.gate.iad3b ([172.31.255.6]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) by proxy13.mail.iad3b.rsapps.net with LMTPS id UJ5zG5Kdt2JRfQAAvUvv+w (envelope-from ) for ; Sat, 25 Jun 2022 19:43:14 -0400 X-Spam-Threshold: 95 X-Spam-Score: 0 X-Spam-Flag: NO X-Virus-Scanned: OK X-Orig-To: openvpnslackdevel@openvpn.net X-Originating-Ip: [216.105.38.7] Authentication-Results: smtp28.gate.iad3b.rsapps.net; iprev=pass policy.iprev="216.105.38.7"; spf=pass smtp.mailfrom="openvpn-devel-bounces@lists.sourceforge.net" smtp.helo="lists.sourceforge.net"; dkim=fail (signature verification failed) header.d=sourceforge.net; dkim=fail (signature verification failed) header.d=sf.net; dmarc=none (p=nil; dis=none) header.from=rfc2549.org X-Suspicious-Flag: YES X-Classification-ID: 93f215be-f4e0-11ec-8dba-525400c8cd63-1-1 Received: from [216.105.38.7] ([216.105.38.7:47846] helo=lists.sourceforge.net) by smtp28.gate.iad3b.rsapps.net (envelope-from ) (ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384) id 7E/5E-32059-19D97B26; Sat, 25 Jun 2022 19:43:14 -0400 Received: from [127.0.0.1] (helo=sfs-ml-4.v29.lw.sourceforge.com) by sfs-ml-4.v29.lw.sourceforge.com with esmtp (Exim 4.94.2) (envelope-from ) id 1o5FPn-0003OZ-2H; Sat, 25 Jun 2022 23:42:09 +0000 Received: from [172.30.20.202] (helo=mx.sourceforge.net) by sfs-ml-4.v29.lw.sourceforge.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1o5FPk-0003OT-QP for openvpn-devel@lists.sourceforge.net; Sat, 25 Jun 2022 23:42:07 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Transfer-Encoding:MIME-Version:References: In-Reply-To:Message-Id:Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:List-Id:List-Help:List-Unsubscribe: List-Subscribe:List-Post:List-Owner:List-Archive; bh=CCYlBqHOK7sCuuFRysyfffsttNJ6BXtUGkDacaJyt18=; b=Q2Lgql2qQfN/rO6cMRcvc8sEG+ dNKbHoAHEe0a1UA4DYlgZm8Hq8XRJ1CTiVPPAG7/eeYyLtqfWUaZPTIXq/azM/7xJL39AsSrSwzMt 8TpzwLnVtE+BJuqu5re2NcsLcCiaSC4+RzEFB5V0kLu/6CdczFrNFaqK43zieg/n8xuc=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x ; h=Content-Transfer-Encoding:MIME-Version:References:In-Reply-To:Message-Id: Date:Subject:To:From:Sender:Reply-To:Cc:Content-Type:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Id:List-Help:List-Unsubscribe:List-Subscribe: List-Post:List-Owner:List-Archive; bh=CCYlBqHOK7sCuuFRysyfffsttNJ6BXtUGkDacaJyt18=; b=cNsFFCy35x+hQqF/pKW8nx+xmT fawHLyaUAzsMplWNT/gt5DSdFYMQ7cnjfiNfnqVqlPpPrMRHHmgZCLjdR28FMB8ScLeTeLu/av0RR /65/Ff41mJA2MDGb2/BRraHeTjFwOd0GLIGxd9l1CQgQDe7nO8i/Fg13GrqXqzuQOb5w=; Received: from mail.blinkt.de ([192.26.174.232]) by sfi-mx-2.v28.lw.sourceforge.com with esmtps (TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.94.2) id 1o5FPi-0002ow-Uu for openvpn-devel@lists.sourceforge.net; Sat, 25 Jun 2022 23:42:07 +0000 Received: from kamera.blinkt.de ([2001:638:502:390:20c:29ff:fec8:535c]) by mail.blinkt.de with smtp (Exim 4.95 (FreeBSD)) (envelope-from ) id 1o5FPT-000Iir-6O for openvpn-devel@lists.sourceforge.net; Sun, 26 Jun 2022 01:41:51 +0200 Received: (nullmailer pid 3398926 invoked by uid 10006); Sat, 25 Jun 2022 23:41:51 -0000 From: Arne Schwabe To: openvpn-devel@lists.sourceforge.net Date: Sun, 26 Jun 2022 01:41:50 +0200 Message-Id: <20220625234150.3398864-5-arne@rfc2549.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20220625234150.3398864-1-arne@rfc2549.org> References: <20220625234150.3398864-1-arne@rfc2549.org> MIME-Version: 1.0 X-Spam-Report: Spam detection software, running on the system "util-spamd-2.v13.lw.sourceforge.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see the administrator of that system for details. Content preview: This changes the default MTU of the tun-mtu to 1420 to avoid MTU related issues that are even more prominent when DCO server or clients are involved. To maximise compatibility to lie our MTU in the default OCC message and keep it at 1500. Content analysis details: (0.2 points, 6.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 SPF_NONE SPF: sender does not publish an SPF Record 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different -0.0 T_SCC_BODY_TEXT_LINE No description available. X-Headers-End: 1o5FPi-0002ow-Uu Subject: [Openvpn-devel] [PATCH v3 5/5] Change default MTU in server mode to 1420 X-BeenThere: openvpn-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: openvpn-devel-bounces@lists.sourceforge.net X-getmail-retrieved-from-mailbox: Inbox This changes the default MTU of the tun-mtu to 1420 to avoid MTU related issues that are even more prominent when DCO server or clients are involved. To maximise compatibility to lie our MTU in the default OCC message and keep it at 1500. Signed-off-by: Arne Schwabe --- doc/man-sections/vpn-network-options.rst | 17 ++++++++++++----- src/openvpn/options.c | 10 ++++++++++ 2 files changed, 22 insertions(+), 5 deletions(-) diff --git a/doc/man-sections/vpn-network-options.rst b/doc/man-sections/vpn-network-options.rst index 9a09aef8b..1dda4912d 100644 --- a/doc/man-sections/vpn-network-options.rst +++ b/doc/man-sections/vpn-network-options.rst @@ -525,11 +525,18 @@ routing. OpenVPN requires that packets on the control and data channels be sent unfragmented. - MTU problems often manifest themselves as connections which hang during - periods of active usage. - - It's best to use the ``--fragment`` and/or ``--mssfix`` options to deal - with MTU sizing issues. + A VPN protocol like OpenVPN adds encapsulation overhead in each packet. If a + VPN packet with the encapsulation becomes larger than the transport network + MTU (typically 1500 or 1492) the packet will become fragmented or completely + dropped. These problems can manifest themselves as connections which hang + during periods of active usage or slower performance. To avoid these problems + it is generally advisable to set the tun MTU small enough to avoid these + problems. The default of 1420 is chosen to be safe with default parameters + and a (transport) network MTU of 1492. + + If lowering the tun MTU to avoid MTU related problems (e.g. when tap is used + and an MTU of 1500 is required), the ``--fragment`` and/or ``--mssfix`` + options can be also used to deal with MTU sizing issues. Note: Depending on the platform, the operating system allows to receive packets larger than ``tun-mtu`` (e.g. Linux and FreeBSD) but other platforms diff --git a/src/openvpn/options.c b/src/openvpn/options.c index f162b0b41..d87c6595c 100644 --- a/src/openvpn/options.c +++ b/src/openvpn/options.c @@ -3032,6 +3032,16 @@ options_postprocess_mutate_ce(struct options *o, struct connection_entry *ce) if (!ce->tun_mtu_defined && !ce->link_mtu_defined) { ce->tun_mtu_defined = true; + if (o->mode == MODE_SERVER && dev != DEV_TYPE_TAP) + { + /* If we are running in P2MP mode we default to a MTU + * that is low enough by default to fit into a 1492 + * MTU UDP IPv6 packet: + * + */ + ce->tun_mtu = frame_calculate_default_mtu(o); + ce->occ_mtu = TUN_MTU_DEFAULT; + } } if ((dev == DEV_TYPE_TAP) && !ce->tun_mtu_extra_defined) {